Skip to content
MozDef: Mozilla Enterprise Defense Platform
Branch: master
Clone or download
pwnbus Fix region parameter in connect_sqs (#1383)
* Fix region parameter in connect_sqs

* Modify parameter names to get_aws_credentials

* Clean up connect_sqs function to call get_aws_credentials

* Cleanup workers to use connect_sqs call

* Fix local import in sqs file

* Fix parameter name in cloudtrail worker

* Assert AWS region of SQS queues

Since the two SQS queues are provisioned by CloudTrail in the same region as the CloudTrail
stack, let's assert to MozDef that the region for those queus is indeed the same region.

* Update region name parameter in cloudtrail worker
Latest commit fa7875f Jul 19, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
alerts Remove unused import from cloudtrail public bucket alert Jul 10, 2019
benchmarking Merge remote-tracking branch 'origin/master' into python_3_upgrade Jul 8, 2019
bot Add config option to suppress slack bot welcome message Jul 16, 2019
cloudy_mozdef Fix region parameter in connect_sqs (#1383) Jul 19, 2019
config Update missing references to alertactions in syslog configs Mar 21, 2019
cron Modify cron scripts to use get_open_indices Jul 18, 2019
docker Improve Dockerfiles Jul 16, 2019
docs Update documentation to conform to new AWS CodeBuild provisioning method Jul 18, 2019
examples Update references to python2 in docs and yml files Jul 1, 2019
loginput Add json array input decode with try catch to fall back to string spl… May 28, 2019
meteor Clarifying form control instructions for tags Jul 13, 2019
mozdef_util Create mozdef_util version 3.0.3 Jul 18, 2019
mq Fix region parameter in connect_sqs (#1383) Jul 19, 2019
rest Fix dashboard kibana url Jul 8, 2019
static removing path to watchlist, removing watchlist from static, adding pr… Oct 30, 2018
systemdfiles Fixup remaining mozdefalertplugin references Mar 22, 2019
tests Add get_open_indices on mozdef_util elasticsearch client Jul 18, 2019
.flake8 Exclude mozdef_util build directory from flake8 checks Apr 9, 2019
.gitignore Vim swp files Apr 30, 2019
.travis.yml Update python version definition in travisci Jun 28, 2019
CHANGELOG Update changelog with note about boto deprecation Jul 8, 2019
CODEOWNERS Update codeowners to include admin set for all clauses May 14, 2019 Add Mozilla Code of Conduct file Mar 28, 2019 Modifying urls to point to mozilla from jeffbryner, slight readabilit… Jun 15, 2017
LICENSE Updated license file to conform with MPL Feb 25, 2014
Makefile Fix Makefile typo Jul 16, 2019 issue fix - typo fix in README.MD Jun 29, 2019
requirements.txt Modify mozdef_util version in requirements Jul 18, 2019

Build Status Documentation Status

MozDef: LOGO


Give MozDef a Try in AWS:

The following button will launch the Mozilla Enterprise Defense Platform in your AWS account.

Warning: Pressing the "Launch Stack" button and following through with the deployment will incur charges to your AWS account.

Launch MozDef


The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis and others are readily available to help attackers coordinate, share intelligence and finely tune their attacks in real time. Defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.

The Mozilla Enterprise Defense Platform (MozDef) seeks to automate the security incident handling process and facilitate the real-time activities of incident handlers.


  • Provide a platform for use by defenders to rapidly discover and respond to security incidents.
  • Automate interfaces to other systems like bunker, cymon, mig
  • Provide metrics for security events and incidents
  • Facilitate real-time collaboration amongst incident handlers
  • Facilitate repeatable, predictable processes for incident handling
  • Go beyond traditional SIEM systems in automating incident handling, information sharing, workflow, metrics and response automation


MozDef is in production at Mozilla where we are using it to process over 300 million events per day.

Survey & Contacting us

If you're interested in running MozDef and would like to give us feedback, please take the following surveys:

These survey also include a contact form where you can reach us if you would like to (it's optional)

Note: These surveys will be open for a limited amount of time, in order to ensure that we look at your feedback in a timely fashion. Thanks for your understanding!

You can’t perform that action at this time.